## golang.org/x/net v0.17.0 vulnerable to HTTP/2 CONTINUATION flood (CVE-2023-45288 / GO-2024-2687)

**CWEs:** CWE-400
**CVSS:** 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
**Component:** openshift-4.14-payload/coredns__release-4.14

### Description
The indirect dependency golang.org/x/net is pinned at v0.17.0. Versions prior to v0.23.0 allow an attacker to send an unbounded sequence of HTTP/2 CONTINUATION frames after a HEADERS frame, forcing the server to buffer and HPACK-decode arbitrary amounts of header data without ever completing the request. CoreDNS links x/net/http2 for its DNS-over-HTTPS server (core/dnsserver/server_https.go) and indirectly via grpc-go and client-go. While the default OpenShift dns-operator Corefile does not enable DoH, the vulnerable code is compiled into the shipped binary and any custom Corefile enabling the https:// block is exposed.

### Affected Locations
- `:`
- `:`

### Evidence
**go.mod:108 — affected by CVE-2023-45288; fixed in v0.23.0**
```go
golang.org/x/net v0.17.0 // indirect
```

### Attack Pattern
Network client with access to the CoreDNS DoH or gRPC port drives unbounded HPACK decoding, OOM-killing the dns-default pods.

---
*Source: Ex-Wing security assessment, finding FIND-002*